** Description changed: [ Impact ] The virtualisation stack has 2 variant base/HWE. HWE ships the same binary packages suffixed with "-hwe". These HWE binary packages (e.g. libvirt-daemon-hwe, libvirt-daemon-log-hwe, ...) reuse the exact same dynamically generated conffiles and system integration files as their base counterparts: - * systemd unit links under /etc/systemd/system/** -> /usr/lib/systemd/... - * apparmor local overrides under /etc/apparmor.d/local/* - * apparmor cache, disable and force-complain entries - * update-rc.d / init.d state + * systemd unit links under /etc/systemd/system/** -> /usr/lib/systemd/... + * apparmor local overrides under /etc/apparmor.d/local/* + * apparmor cache, disable and force-complain entries + * update-rc.d / init.d state Because both the base package and the HWE package own the same paths, purging one package removes the files that the other one still relies on. For example: - $ apt install libvirt-daemon-log - $ apt install libvirt-daemon-log-hwe - $ apt purge libvirt-daemon-log + $ apt install libvirt-daemon-log + $ apt install libvirt-daemon-log-hwe + $ apt purge libvirt-daemon-log leaves libvirt-daemon-log-hwe installed but broken: the shared virtlogd systemd unit link is deleted by the base package's postrm, so the daemon shipped by the HWE package no longer starts correctly. The same class of breakage happens in both directions (purging the HWE package while the base package is installed) and affects several packages across the interlinked HWE stack (libvirt, qemu, edk2, seabios and their -hwe variants). As of now, only a subset of virt packages are affected by this issue. They are mostly the packages that have dynamic conffiles (systemd service, ). However, the proposed fix cover all the packages in the virtualization set: - - seabios - - libvirt - - edk2 - - qemu + - seabios + - libvirt + - edk2 + - qemu to prevent this issue from happening in case we SRU an other fix that makes use of a dynamic conffile. [ Test Plan ] On a clean Resolute system with the fixed packages installed: - 1. Install a base package and its HWE counterpart: - $ sudo apt install libvirt-daemon-log - $ sudo apt install libvirt-daemon-log-hwe + 1. Install a base package and its HWE counterpart: + $ sudo apt install libvirt-daemon-log + $ sudo apt install libvirt-daemon-log-hwe - 2. Purge the base package: - $ sudo apt purge libvirt-daemon-log + 2. Purge the base package: + $ sudo apt purge libvirt-daemon-log - 3. Verify the HWE package is still fully functional, i.e. the shared - systemd unit link is still present and the daemon is usable: - $ systemctl status virtlogd - The unit must still be loaded (link under /usr/lib/systemd/system - intact) and startable. + 3. Verify the HWE package is still fully functional, i.e. the shared + systemd unit link is still present and the daemon is usable: + $ systemctl status virtlogd + The unit must still be loaded (link under /usr/lib/systemd/system + intact) and startable. - 4. Repeat the reverse direction (purge the -hwe package while the base - package is installed) and confirm the base package is unaffected. + 4. Repeat the reverse direction (purge the -hwe package while the base + package is installed) and confirm the base package is unaffected. - 5. Purge both packages and confirm the shared files are correctly - cleaned up (no leftover systemd links / apparmor local entries) once - no counterpart remains installed. + 5. Purge both packages and confirm the shared files are correctly + cleaned up (no leftover systemd links / apparmor local entries) once + no counterpart remains installed. + + IMPORTANT: You might fail to reproduce the issue due to an other bug: + https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/2164744 + that causes the purge command of to hang. You can patch the deb-system-hyelper binary based on this proposed patch: https://code.launchpad.net/~hectorcao/ubuntu/+source/init-system-helpers/+git/init-system-helpers/+merge/509963 + to temporarily fix the sibling. [ Where problems could occur ] The fix inserts a snippet at the top of each package's postrm (via execute_after_dh_installdeb in d/rules) that sources a shared purge hook. On "purge", the hook skips the dpkg-maintscript purge actions when the counterpart stack is still installed, deferring the cleanup until the last of the base/HWE pair is removed. Risk areas: - * The change only affects the maintainer scripts (postrm) and packaging - metadata; there is no change to the runtime binaries. A regression - would therefore manifest at install/upgrade/remove/purge time rather - than at runtime. + * The change only affects the maintainer scripts (postrm) and packaging + metadata; there is no change to the runtime binaries. A regression + would therefore manifest at install/upgrade/remove/purge time rather + than at runtime. - * If the hook logic were wrong it could either (a) leave shared files - behind after both packages are purged, or (b) fail to protect the - counterpart. + * If the hook logic were wrong it could either (a) leave shared files + behind after both packages are purged, or (b) fail to protect the + counterpart. - * The postrm snippet depends on ubuntu-helper-virt-hwe providing - /usr/share/ubuntu-helper-virt-hwe/ubuntu_virt_postrm_hook; a version - constraint on ubuntu-virt-hwe / ubuntu-helper-virt-hwe was added to - d/control(.in) to guarantee the hook is present. The snippet guards - the source with a file-existence test, so a missing helper degrades - to the previous behaviour rather than failing the postrm. - + * The postrm snippet depends on ubuntu-helper-virt-hwe providing + /usr/share/ubuntu-helper-virt-hwe/ubuntu_virt_postrm_hook; a version + constraint on ubuntu-virt-hwe / ubuntu-helper-virt-hwe was added to + d/control(.in) to guarantee the hook is present. The snippet guards + the source with a file-existence test, so a missing helper degrades + to the previous behaviour rather than failing the postrm. [ Other Info ] - --- Original bug report --- Since libvirt-daemon-log-hwe have the same dynamic conffiles (systemd links, apparmor local) than libvirt-daemon-log When libvirt-daemon-log-hwe is installed, purging libvirt-daemon-log might break libvirt-daemon-log-hwe by removing the systemd unit links (/etc/systemd/system/** -> /usr/lib/). Other packages are also affected, for example libvirt-daemon. Here are the purge actions done by dh-* for libvirt-daemon in the postrm maintscript: ... update-rc.d libvirtd remove deb-systemd-helper purge 'libvirtd-admin.socket' 'libvirtd-ro.socket' 'libvirtd.socket' deb-systemd-helper purge 'libvirtd.service' >/dev/null rm -f "/etc/apparmor.d/disable/usr.sbin.libvirtd" || true rm -f "/etc/apparmor.d/force-complain/usr.sbin.libvirtd" || true rm -f "/etc/apparmor.d/local/usr.sbin.libvirtd" || true rm -f /var/cache/apparmor/*/"usr.sbin.libvirtd" || true rmdir /etc/apparmor.d/disable 2>/dev/null || true rmdir /etc/apparmor.d/local 2>/dev/null || true rmdir /etc/apparmor.d 2>/dev/null || true Steps to reproduce --- $ apt install libvirt-daemon-log $ apt install libvirt-daemon-log-hwe $ apt purge libvirt-daemon-log $ systemci status virtlogd ● virtlogd.service - libvirt logging daemon Loaded: loaded (/usr/lib/systemd/system/virtlogd.service; disabled; preset: enabled)
** Description changed: [ Impact ] The virtualisation stack has 2 variant base/HWE. HWE ships the same binary packages suffixed with "-hwe". These HWE binary packages (e.g. libvirt-daemon-hwe, libvirt-daemon-log-hwe, ...) reuse the exact same dynamically generated conffiles and system integration files as their base counterparts: * systemd unit links under /etc/systemd/system/** -> /usr/lib/systemd/... * apparmor local overrides under /etc/apparmor.d/local/* * apparmor cache, disable and force-complain entries * update-rc.d / init.d state Because both the base package and the HWE package own the same paths, purging one package removes the files that the other one still relies on. For example: $ apt install libvirt-daemon-log $ apt install libvirt-daemon-log-hwe $ apt purge libvirt-daemon-log leaves libvirt-daemon-log-hwe installed but broken: the shared virtlogd systemd unit link is deleted by the base package's postrm, so the daemon shipped by the HWE package no longer starts correctly. The same class of breakage happens in both directions (purging the HWE package while the base package is installed) and affects several packages across the interlinked HWE stack (libvirt, qemu, edk2, seabios and their -hwe variants). As of now, only a subset of virt packages are affected by this issue. They are mostly the packages that have dynamic conffiles (systemd service, ). However, the proposed fix cover all the packages in the virtualization set: - seabios - libvirt - edk2 - qemu to prevent this issue from happening in case we SRU an other fix that makes use of a dynamic conffile. [ Test Plan ] On a clean Resolute system with the fixed packages installed: 1. Install a base package and its HWE counterpart: $ sudo apt install libvirt-daemon-log $ sudo apt install libvirt-daemon-log-hwe 2. Purge the base package: $ sudo apt purge libvirt-daemon-log 3. Verify the HWE package is still fully functional, i.e. the shared systemd unit link is still present and the daemon is usable: $ systemctl status virtlogd The unit must still be loaded (link under /usr/lib/systemd/system intact) and startable. 4. Repeat the reverse direction (purge the -hwe package while the base package is installed) and confirm the base package is unaffected. 5. Purge both packages and confirm the shared files are correctly cleaned up (no leftover systemd links / apparmor local entries) once no counterpart remains installed. IMPORTANT: You might fail to reproduce the issue due to an other bug: - https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/2164744 + https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/2164744 that causes the purge command of to hang. You can patch the deb-system-hyelper binary based on this proposed patch: https://code.launchpad.net/~hectorcao/ubuntu/+source/init-system-helpers/+git/init-system-helpers/+merge/509963 - to temporarily fix the sibling. + to temporarily fix the sibling issue. [ Where problems could occur ] The fix inserts a snippet at the top of each package's postrm (via execute_after_dh_installdeb in d/rules) that sources a shared purge hook. On "purge", the hook skips the dpkg-maintscript purge actions when the counterpart stack is still installed, deferring the cleanup until the last of the base/HWE pair is removed. Risk areas: * The change only affects the maintainer scripts (postrm) and packaging metadata; there is no change to the runtime binaries. A regression would therefore manifest at install/upgrade/remove/purge time rather than at runtime. * If the hook logic were wrong it could either (a) leave shared files behind after both packages are purged, or (b) fail to protect the counterpart. * The postrm snippet depends on ubuntu-helper-virt-hwe providing /usr/share/ubuntu-helper-virt-hwe/ubuntu_virt_postrm_hook; a version constraint on ubuntu-virt-hwe / ubuntu-helper-virt-hwe was added to d/control(.in) to guarantee the hook is present. The snippet guards the source with a file-existence test, so a missing helper degrades to the previous behaviour rather than failing the postrm. [ Other Info ] --- Original bug report --- Since libvirt-daemon-log-hwe have the same dynamic conffiles (systemd links, apparmor local) than libvirt-daemon-log When libvirt-daemon-log-hwe is installed, purging libvirt-daemon-log might break libvirt-daemon-log-hwe by removing the systemd unit links (/etc/systemd/system/** -> /usr/lib/). Other packages are also affected, for example libvirt-daemon. Here are the purge actions done by dh-* for libvirt-daemon in the postrm maintscript: ... update-rc.d libvirtd remove deb-systemd-helper purge 'libvirtd-admin.socket' 'libvirtd-ro.socket' 'libvirtd.socket' deb-systemd-helper purge 'libvirtd.service' >/dev/null rm -f "/etc/apparmor.d/disable/usr.sbin.libvirtd" || true rm -f "/etc/apparmor.d/force-complain/usr.sbin.libvirtd" || true rm -f "/etc/apparmor.d/local/usr.sbin.libvirtd" || true rm -f /var/cache/apparmor/*/"usr.sbin.libvirtd" || true rmdir /etc/apparmor.d/disable 2>/dev/null || true rmdir /etc/apparmor.d/local 2>/dev/null || true rmdir /etc/apparmor.d 2>/dev/null || true Steps to reproduce --- $ apt install libvirt-daemon-log $ apt install libvirt-daemon-log-hwe $ apt purge libvirt-daemon-log $ systemci status virtlogd ● virtlogd.service - libvirt logging daemon Loaded: loaded (/usr/lib/systemd/system/virtlogd.service; disabled; preset: enabled) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2164849 Title: purging libvirt-daemon when libvirt-daemon-hwe is installed breaks libvirt-daemon-hwe To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/edk2/+bug/2164849/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
